dashboard
可以從微軟中國提供的 gcr.io ：http://mirror.azure.cn/help/gcr-proxy-cache.html免費代理下載下傳被牆的鏡像
docker pull gcr.azk8s.cn/google_containers/<imagename>:<version>
1. 下載下傳檔案
下載下傳三個檔案：https://github.com/gjmzj/kubeasz/tree/master/manifests/dashboard
[root@hs-k8s-master01 dashboard]# pwd
/data/k8s/dashboard
[root@hs-k8s-master01 dashboard]# ll
總用量 32
-rw-r--r-- 1 root root 843 2月 5 15:31 admin-user-sa-rbac.yaml
-rw-r--r-- 1 root root 8026 2月 5 15:38 kubernetes-dashboard.yaml
-rw-r--r-- 1 root root 3084 2月 5 15:33 read-user-sa-rbac.yaml
2. 部署dashboard主yaml配置檔案
#修改鏡像下載下傳位址
[root@hs-k8s-master01 dashboard]# cat kubernetes-dashboard.yaml |grep image
image: registry.cn-hangzhou.aliyuncs.com/google_containers/dashboard:v2.0.0-rc3
image: registry.cn-hangzhou.aliyuncs.com/google_containers/metrics-scraper:v1.0.3
[root@hs-k8s-master01 dashboard]# kubectl apply -f kubernetes-dashboard.yaml
secret/kubernetes-dashboard-certs created
serviceaccount/kubernetes-dashboard created
role.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-minimal created
deployment.apps/kubernetes-dashboard created
service/kubernetes-dashboard created
3. 建立可讀可寫admin Service Account
[root@hs-k8s-master01 dashboard]# kubectl apply -f admin-user-sa-rbac.yaml
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user created
4. 建立隻讀 read Service Account
[root@hs-k8s-master01 dashboard]# kubectl apply -f read-user-sa-rbac.yaml
serviceaccount/dashboard-read-user created
clusterrolebinding.rbac.authorization.k8s.io/dashboard-read-binding created
clusterrole.rbac.authorization.k8s.io/dashboard-read-clusterrole created
5. 檢視
#檢視pod運作狀态
[root@hs-k8s-master01 dashboard]# kubectl get pod -n kube-system | grep dashboard
dashboard-metrics-scraper-6b66849c9-8lvqd 1/1 Running 0 23m
kubernetes-dashboard-6dc6c4f59-84526 1/1 Running 0 23m
#檢視dashboard service
[root@hs-k8s-master01 dashboard]# kubectl get svc -n kube-system|grep dashboard
dashboard-metrics-scraper ClusterIP 10.107.131.160 <none> 8000/TCP 23m
kubernetes-dashboard NodePort 10.99.144.160 <none> 443:31110/TCP 23m
#檢視叢集服務
[root@hs-k8s-master01 dashboard]# kubectl cluster-info
Kubernetes master is running at https://20.0.0.250:8443
KubeDNS is running at https://20.0.0.250:8443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
kubernetes-dashboard is running at https://20.0.0.250:8443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
#檢視pod運作日志
[root@hs-k8s-master01 dashboard]# kubectl logs kubernetes-dashboard-6dc6c4f59-84526 -n kube-system
6. 生成證書
供本地google浏覽器使用
#生成client-certificate-data
[root@k8s-master01 dashboard]# grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt
#生成client-key-data
[root@k8s-master01 dashboard]# grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key
#生成p12
[root@k8s-master01 dashboard]# openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-client"
Enter Export Password: 1
Verifying - Enter Export Password: 1
[root@hs-k8s-master01 dashboard]# ll
總用量 28
-rw-r--r-- 1 root root 843 2月 5 15:31 admin-user-sa-rbac.yaml
-rw-r--r-- 1 root root 1082 2月 5 15:41 kubecfg.crt
-rw-r--r-- 1 root root 1679 2月 5 15:41 kubecfg.key
-rw-r--r-- 1 root root 2464 2月 5 15:43 kubecfg.p12
-rw-r--r-- 1 root root 8026 2月 5 15:38 kubernetes-dashboard.yaml
-rw-r--r-- 1 root root 3084 2月 5 15:33 read-user-sa-rbac.yaml
[root@k8s-master01 dashboard]# sz kubecfg.p12
谷歌浏覽器導入證書：
備注把上一步驟的kubecfg.p12 檔案導入證書後需要重新開機浏覽器：
7. 導出令牌
[root@hs-k8s-master01 dashboard]# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
Name: admin-user-token-4d2r4
Namespace: kube-system
Labels: <none>
Annotations: kubernetes.io/service-account.name: admin-user
kubernetes.io/service-account.uid: cf8638e0-1434-4f61-aded-262f213dd803
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1025 bytes
namespace: 11 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjZaOTZ5MmR5MEs3eUVnclJ4R0MtOTNmVDlTTGlteGdzQ1RJc1ZZT2xvT00ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLTRkMnI0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJjZjg2MzhlMC0xNDM0LTRmNjEtYWRlZC0yNjJmMjEzZGQ4MDMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.HXlI_vXP4b9VVP6_jptMFjp99u1NLlmgC26ITfA7cHRPIyjxW6vKv97GjAOxF3Ne691cTZLcOAh_b1dNXExLkmUqKoWY8Cg_ys5hvQ2rcC_CEpS7S4shKWEb_DeLUUgr4UjjIDQKCH_tczX3nNpfsqiooMsMYkac-MlwgCHVvxgkqKmfrkub6ifP02yuaWBLhvuYvJc6DX_NvHQzy9w8FFbB2d4gpthzt_sinSR4x84MzgKHdOsj9CHXqwHMdCMwu0A-FM-bg7yr1fHZLKORrSrHz9OZ1pJeU-82VYRSOEntW7o6X3b0zOi2nB6yIpDmVDzzk5g30sI32vivmrNEJg
#導出令牌
[root@k8s-master01 dashboard]# vim /root/.kube/config 加
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjZaOTZ5MmR5MEs3eUVnclJ4R0MtOTNmVDlTTGlteGdzQ1RJc1ZZT2xvT00ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLTRkMnI0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJjZjg2MzhlMC0xNDM0LTRmNjEtYWRlZC0yNjJmMjEzZGQ4MDMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.HXlI_vXP4b9VVP6_jptMFjp99u1NLlmgC26ITfA7cHRPIyjxW6vKv97GjAOxF3Ne691cTZLcOAh_b1dNXExLkmUqKoWY8Cg_ys5hvQ2rcC_CEpS7S4shKWEb_DeLUUgr4UjjIDQKCH_tczX3nNpfsqiooMsMYkac-MlwgCHVvxgkqKmfrkub6ifP02yuaWBLhvuYvJc6DX_NvHQzy9w8FFbB2d4gpthzt_sinSR4x84MzgKHdOsj9CHXqwHMdCMwu0A-FM-bg7yr1fHZLKORrSrHz9OZ1pJeU-82VYRSOEntW7o6X3b0zOi2nB6yIpDmVDzzk5g30sI32vivmrNEJg
[root@k8s-master01 dashboard]# cp /root/.kube/config /data/k8s/tmp/k8s-dashboard.kubeconfig
[root@k8s-master01 dashboard]# sz /data/k8s/tmp/k8s-dashboard.kubeconfig 過手如登山，一步一重天